Running openra (20171014, mono5+SDL+OpenGL) under i3-wm and switching workspaces 3-4 times quickly leads to a crash in the i965 code:
Thread 1 (Thread 0x7fb469096780 (LWP 25267)):
#0 0x00007fb468557697 in waitpid () from /usr/lib/libpthread.so.0
#1 0x000055bd82cc9ff0 in mono_handle_native_crash (signal=<optimized out>, signal@entry=0x55bd82ec6333 "SIGSEGV", ctx=ctx@entry=0x7ffc61d9bd40, info=info@entry=0x7ffc61d9be70) at mini-exceptions.c:2567
#2 0x000055bd82c3fee5 in mono_sigsegv_signal_handler (_dummy=11, _info=0x7ffc61d9be70, context=0x7ffc61d9bd40) at mini-runtime.c:2868
#3 <signal handler called>
#4 brw_bo_get_tiling (bo=bo@entry=0x51, tiling_mode=tiling_mode@entry=0x7ffc61d9c2f8, swizzle_mode=swizzle_mode@entry=0x7ffc61d9c2fc) at brw_bufmgr.c:1104
#5 0x00007fb45b2198fa in intel_miptree_create_for_bo (brw=brw@entry=0x55bd84d997e0, bo=0x51, format=format@entry=MESA_FORMAT_B8G8R8X8_UNORM, offset=0, width=80, height=0, depth=1, pitch=-1979489440, flags=MIPTREE_CREATE_DEFAULT) at intel_mipmap_tree.c:850
#6 0x00007fb45b219b5a in intel_miptree_create_for_dri_image (brw=brw@entry=0x55bd84d997e0, image=image@entry=0x55bd89c890d0, target=target@entry=3553, format=MESA_FORMAT_B8G8R8X8_UNORM, is_winsys_image=is_winsys_image@entry=true) at intel_mipmap_tree.c:1039
#7 0x00007fb45b1ee5c5 in intel_update_image_buffer (intel=intel@entry=0x55bd84d997e0, rb=rb@entry=0x55bd84f4e2c0, buffer=0x55bd89c890d0, buffer_type=buffer_type@entry=__DRI_IMAGE_BUFFER_BACK, drawable=<optimized out>) at brw_context.c:1632
#8 0x00007fb45b1f1242 in intel_update_image_buffers (drawable=0x55bd84f3fea0, brw=0x55bd84d997e0) at brw_context.c:1703
#9 intel_update_renderbuffers (context=context@entry=0x55bd84dc6870, drawable=drawable@entry=0x55bd84f3fea0) at brw_context.c:1361
#10 0x00007fb45b1f1531 in intel_prepare_render (brw=brw@entry=0x55bd84d997e0) at brw_context.c:1382
#11 0x00007fb45b1ecdee in brw_clear (ctx=0x55bd84d997e0, mask=18) at brw_clear.c:278
Commenting out the GL.Clear() call in OpenRA leads to a similar crash somewhere else (typically from GL draw primitives).
In the backtrace, the pointer to bo looks pretty much invalid (0x51), leading to a crash in brw_bo_get_tiling when dereferencing it.
Since the trace was randomly changing, I added some debug in intel_update_image_buffer(), and it looks like there is a memory corruption happening in __DRIimageRec struct (intel one):
bo is definitely a broken pointer, 0xda196040 is way too huge to be a valid pitch (even interpreted as negative), 0x55fd doesn't look like a valid GL internal format (previous calls are 0x1907 / GL_RGB), dri_format also got changed from 0x1002. I didn't check any further in the struct to see where the corruption starts, maybe I should?
Most likely the same issue as in bug 104214. Try the patch from comment 29 on that bug.
I can confirm the patch in bug 104214 fixes this issue as well. Thank you.
*** This bug has been marked as a duplicate of bug 104214 ***